Anyvoc
← Home

Privacy Policy

Last updated: 2026-07-27.

This privacy policy explains which personal data the Anyvoc mobile app and the associated websites at anyvoc.eu process, for what purpose, and on what legal basis.

1. Controller

The controller in the sense of Art. 4 (7) GDPR is the operator of Anyvoc. Full name and postal address are listed in the imprint.

Email: feedback@anyvoc.eu

2. Website hosting and server logs (anyvoc.eu)

The website anyvoc.eu is hosted on GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. When you visit the site, GitHub processes the technical access data required to deliver the page (IP address, timestamp, requested URL, HTTP status, user agent, referrer). These request data are processed in standard web-server log files on GitHub's infrastructure.

Purpose: Delivery of the page, security (abuse / DDoS protection), basic operational integrity. We ourselves do not access these logs and do not link them to any user account.

Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in operating a publicly available website.

Third-country transfer: GitHub is a US company; processing may occur in the USA. The transfer is based on the EU-US Data Privacy Framework (GitHub is certified) and the Standard Contractual Clauses according to Art. 46 (2) (c) GDPR. Details: GitHub Privacy Statement.

Retention: Server-side log retention is governed by GitHub's policy and is not under our control. We do not download, store, or analyse these logs ourselves.

The website itself is purely static and contains no analytics, no tracking pixels, no advertising networks, and no third-party embeds. Web fonts (Inter) are self-hosted on the same domain and are not loaded from a third party.

3. Principle: your data stays on your device

Anyvoc stores all vocabulary, content, learning progress, and settings locally on your device in a SQLite database. There is no cloud sync, no server-side account for your vocabulary data, and no analysis of your learning content on our side.

The app's external connections are limited to:

If you use the app in guest mode and don't submit any content or links for vocabulary extraction, no personal data is transferred to external services.

4. Local storage on your device

The following categories are stored exclusively in the app's local SQLite database:

This data is stored only on your device. Parts of it leave the device in exactly two user-triggered cases: the text of content you submit for extraction or translation is transmitted transiently to the LLM backend (section 6), and the backup feature exports your vocabulary database as a file whose destination you choose yourself in your device's share dialog — the app itself uploads nothing. The data is deleted when you:

Legal basis: Art. 6 (1) (b) GDPR (performance of contract — the app cannot fulfil its function without local storage).

5. Authentication via Supabase (optional)

Anyvoc can be used without sign-in, in guest mode. Users sign in for one of these reasons:

The following data is sent to Supabase during sign-in:

Supabase stores for your account:

Tokens are stored encrypted on your device via expo-secure-store (iOS Keychain, Android Keystore).

Processor: Supabase Inc., hosted in the EU Frankfurt region (eu-central-1, AWS Frankfurt). A data processing agreement under Art. 28 GDPR is in place. Application data is stored and processed in the EU; Supabase Inc. is a US company, and any residual access from outside the EU (e.g. for support or platform administration) is covered by the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) under that agreement.

Email delivery: The one-time login code is sent to you by email through our transactional email provider, Resend (Resend, Inc., USA), acting as our processor; it receives only your email address and the code, for the sole purpose of delivering the message. Transfer to the USA relies on the Standard Contractual Clauses (Art. 46 (2) (c) GDPR).

Legal basis: Art. 6 (1) (b) GDPR (performance of contract — no Pro purchase without an account; in pure guest mode this processing does not occur at all).

Deletion: You can delete your account at any time in the app under Settings → Account → Delete Account. The account record at Supabase is then deleted immediately and irrevocably; residual copies in the processor's routine database backups and authentication logs expire automatically within the processor's standard retention window. Local vocabulary data is removed from the device in the same step. If you cannot reach the in-app flow, you can also request account deletion via the web.

6. LLM backend for vocabulary extraction

When you submit content (text, image OCR, web link) to the app for vocabulary extraction or translation, the app sends the relevant text content to our backend proxy. The proxy forwards the request to an LLM provider.

Web links: When you add or share a link, your device fetches that page directly — the target website therefore sees your IP address and the usual request metadata, exactly as if you had opened the page in a browser. The readable article text is normally extracted locally on your device. Only if that local extraction fails is the fetched page content (capped in size) sent to our backend proxy so the LLM can extract the article text instead.

What data: The text of the content to be analysed (e.g. a Wikipedia excerpt, an OCR result, one of your own notes). If this text contains personal data, that data is transferred along with it — therefore, do not submit sensitive or third-party personal data to the app that is not intended for LLM analysis.

What we log: Per request, our backend writes a structured log entry with the fields at, tier, model, provider. No content data, no IP address, no user ID, no headers. On upstream errors, the LLM provider's error message is additionally logged for debugging — never the submitted text itself. These logs serve solely error- and cost-analysis and are not stored in a way that could be linked to your account or device.

Backend hosting processor: Fly.io, Inc., USA. The application server runs in the "cdg" region (Paris, France, EU). At the host's infrastructure level, technical logs (IP addresses, timestamps, HTTP statuses) are produced as is normal for any web host. These are deleted automatically per the host's retention policy and are not analysed by us. Fly.io is bound to GDPR-conformant Standard Contractual Clauses.

LLM provider processor:

Mistral AI, Paris, France (EU). Mistral (currently mistral-small-latest) processes the submitted content to generate the AI response and retains API requests for abuse detection for 30 rolling days per its published data-retention policy (see Mistral's privacy documentation at mistral.ai). Mistral, per its API terms, does not use the data for model training.

Third-party transfer: Although Mistral acts as our data processor under the GDPR, this content is processed by a separate company rather than solely on our own systems. For transparency — and consistent with app-store data-safety disclosures — we therefore also treat the submitted content as data shared with a third party, solely to provide the vocabulary-extraction and translation features. No other data (e.g. your email or user ID) is shared with the LLM provider.

This privacy policy will be updated should the routing configuration change to add or replace the LLM provider.

Legal basis: Art. 6 (1) (b) GDPR (performance of contract — no LLM call, no vocabulary extraction). If you do not want LLM processing, avoid the "Add content" function and use only manual vocabulary entry.

7. On-device text recognition (OCR) and speech-to-text

Images you hand to the app via the photo library or camera are processed on-device with Google ML Kit Text Recognition (@infinitered/react-native-mlkit-text-recognition). This applies to both iOS and Android: the library binds the native Google ML Kit SDK on each platform (GoogleMLKit/TextRecognition pod on iOS, com.google.mlkit:text-recognition on Android). No image content and no extracted text is sent to Google for the OCR itself.

Only the extracted text is, if you choose vocabulary extraction, forwarded to our own LLM backend proxy (see section 6) — never to Google.

SDK-level telemetry: The Google ML Kit SDK may transmit anonymous diagnostic and quality signals to Google (e.g. SDK version, success / failure rates, model performance statistics). These signals contain no image content, no extracted text, and are not linked to any user identifier we hold. The processing is governed by the Google ML Kit Terms of Service and Google's privacy documentation. These signals are processed by Google LLC, Mountain View, USA, acting as an independent controller for its own SDK quality purposes; transfer based on the EU-US Data Privacy Framework and Standard Contractual Clauses.

Legal basis for using the SDK despite these diagnostics: Art. 6 (1) (f) GDPR — our legitimate interest in providing a functioning, quality-assured on-device text recognition without sending your images to any server. You can object to processing based on legitimate interest at any time (see section 12).

Speech-to-text (voice input): If you use the optional voice-input feature to dictate vocabulary source text, the audio is transcribed on your device using the operating system's offline speech recogniser. The recording is not streamed to Google, Apple, or any other server. Only the resulting text remains on your device — and is forwarded for vocabulary extraction only if you then choose to (see section 6). If your device has no offline speech model installed for the selected language, voice input reports an error rather than falling back to a cloud recogniser, so audio never leaves the device.

8. Permissions the app requests

PermissionPurpose
InternetBackend requests to our proxy and to Supabase
CameraOptional, to photograph vocabulary source texts (OCR)
Photo library (iOS)Optional, to pick text-bearing images from the gallery
Audio recordingOptional, for on-device speech-to-text vocabulary input — audio is processed on your device and never sent to a server

You can revoke camera, photo-library, and microphone permissions at any time in your device's system settings. Internet access is required for sign-in and LLM features; without internet, the app stays usable in pure offline mode with locally-stored vocabulary.

9. Paid features (future)

Once the paid Pro features are activated, billing runs exclusively through your store's payment system (Apple App Store or Google Play). Anyvoc only receives confirmation from the store of whether you have an active Pro entitlement — no payment data, no credit-card details, no bank information.

We plan to use RevenueCat as the receipt-validation layer. Once that service is live, this privacy policy will be amended with the relevant section.

10. Crash reporting (future)

We plan to collect anonymous crash reports via Sentry to fix app crashes. Such reports contain stack traces, device model, and operating-system version, but no personal data, no vocabulary content, no email. Once crash reporting is active, this privacy policy will be updated accordingly.

11. Cookies and tracking

Neither the app nor the website anyvoc.eu sets any cookies of their own, uses tracking pixels, ad networks, or analytics SDKs. The website is fully static; no consent banner is required because no non-essential storage of or access to information on the visitor's device takes place (§ 25 TDDDG in Germany — formerly TTDSG; regulation 6 PECR in the UK; and the corresponding ePrivacy rules elsewhere in the EEA).

The same holds inside the app: everything the app stores on your device (the local vocabulary database, sign-in session tokens, the guest-session counter) is strictly necessary for the service you explicitly request and therefore requires no consent (§ 25 (2) no. 2 TDDDG and its equivalents).

12. Your rights under GDPR

You have the right at any time to:

Where processing is based on consent, you can withdraw it at any time.

Right to object (Art. 21 GDPR): where we base processing on legitimate interest (website server logs, section 2; SDK diagnostics, section 7), you have the right to object at any time, on grounds relating to your particular situation, to that processing. To object, email feedback@anyvoc.eu.

Anyvoc performs no automated decision-making producing legal or similarly significant effects within the meaning of Art. 22 GDPR, and no profiling.

Providing personal data is never a statutory requirement. Providing an email address is required only if you create an account — it is the contractual identifier for sign-in; in guest mode no personal data needs to be provided at all.

Please direct such requests to feedback@anyvoc.eu. Since we hold very little personal data server-side (only the sign-in account, if any), an information request can usually be answered within a few days.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Postfach 10 29 32, 70025 Stuttgart, Germany
https://www.baden-wuerttemberg.datenschutz.de/

13. EEA residents (Norway, Iceland, Liechtenstein)

If you reside in Norway, Iceland, or Liechtenstein, the General Data Protection Regulation (GDPR) applies to you in the same way as to residents of EU member states, because these countries have adopted the GDPR into the EEA Agreement. The rights set out in section 12 (Art. 15 through Art. 21 GDPR) therefore apply unchanged. You may lodge complaints either with the supervisory authority listed in section 12 (Baden-Württemberg) or with your national supervisory authority (Datatilsynet in Norway, Persónuvernd in Iceland, Datenschutzstelle in Liechtenstein).

14. UK residents (UK GDPR / Data Protection Act 2018)

If you reside in the United Kingdom, the UK GDPR (Regulation (EU) 2016/679 as it forms part of UK domestic law) and the Data Protection Act 2018 apply. The rights granted under the UK GDPR mirror those listed in section 12; you may exercise them via the same email channel: feedback@anyvoc.eu.

The competent UK supervisory authority is:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
https://ico.org.uk/

For UK users, cross-border data flows rely on the following mechanisms: (a) transfers to the EU / EEA (sign-in backend, section 5; LLM processing, section 6) rely on the UK adequacy regulations in respect of the EU / EEA; (b) transfers to recipients in the USA (GitHub, Inc. for hosting of this website, section 2; Google LLC for SDK diagnostics, section 7) rely on the recipients' certification under the UK Extension to the EU-US Data Privacy Framework (in force since 12 October 2023); and (c) where a US recipient is not certified under the UK Extension, on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

15. Swiss residents (FADP)

If you reside in Switzerland, the Swiss Federal Act on Data Protection (FADP / DSG, in force since 1 September 2023) applies in addition to or instead of the GDPR, depending on the processing context. The FADP grants you rights that are functionally equivalent to those listed in section 12, in particular:

You can exercise these rights via the same email channel as for GDPR requests: feedback@anyvoc.eu.

Cross-border disclosure (Art. 16–17 FADP): where your data is disclosed abroad, this happens to France and other EU / EEA states (LLM processing, section 6; sign-in backend, section 5) — states the Swiss Federal Council recognises as providing adequate protection — and to the USA (hosting of this website, section 2; SDK diagnostics, section 7). Disclosures to the USA rely on the recipient's certification under the Swiss-U.S. Data Privacy Framework (adequacy decision in force since 15 September 2024) or, where a recipient is not so certified, on the EU Standard Contractual Clauses with the adaptations for Swiss law recognised by the FDPIC.

The competent Swiss supervisory authority is:

Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB) /
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern, Switzerland
https://www.edoeb.admin.ch/

16. Contact by email

When you email us (support, feedback, account deletion, or other data-subject requests), we process your email address and the content of your message in order to handle the request. Legal basis: Art. 6 (1) (b) GDPR where the request concerns your account or contract, Art. 6 (1) (c) for data-subject rights we are legally obliged to handle, otherwise Art. 6 (1) (f) (our legitimate interest in answering inquiries). Emails are received and stored by our email hosting provider, which acts as our processor. Correspondence is deleted once the matter is resolved; documentation of data-subject requests is kept for up to three years for accountability purposes (Art. 5 (2) GDPR).

17. Children

Anyvoc is not directed at children under 13. Use of the app is permitted from the age of 13 (see the Terms of Use, section 5), in line with the target audience we declare in the app stores.

We do not ask for your date of birth and the app has no age gate. None of the processing described in this policy is based on consent, so the age thresholds of Art. 8 GDPR are not engaged; and a date of birth is not necessary in order to provide the service, so we do not collect one (Art. 5 (1) (c) GDPR, data minimisation). Apple and Google apply their own account age requirements and family / parental-control mechanisms to the store account used to install the app.

We do not knowingly collect personal data from children under 13 — the only server-side personal data we hold at all is the optional sign-in record described in section 5. If you are a parent or guardian and believe a child under 13 has created an account, contact us at feedback@anyvoc.eu and we will delete it.

18. Security

All connections between the app, our backend, and our processors are encrypted in transit (TLS/HTTPS). Sign-in session tokens are stored on your device in the operating system's secure storage (iOS Keychain / Android Keystore). We store no user content server-side. In the event of a personal data breach, we notify the competent supervisory authority and, where required, affected users in accordance with Art. 33 and 34 GDPR.

19. Changes to this privacy policy

We may amend this privacy policy when the app, the processing purposes, or the legal framework changes. The current version is available at https://anyvoc.eu/legal/privacy.html. For material changes we notify you in the app.